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SUMMARY 


INTRODUCTION 

Prior  to  the  start  of  the  work  reported  here,  the  Naval 
Air  Development  Center  (NADC)  spent  considerable  effort  proving 
the  feasibility  and  effectiveness  of  an  inflatable  body  and 
head  restraint  system  (IBAHRS).  The  IBAHRS  consists  of  a  con¬ 
ventional  restraint  system  to  which  a  pyrotechnically  ignited 
gas  generator  and  load  distributing  bladders  have  been  a^ded. 

The  pyrotechnic  is  fired  electrically  by  closure  of  the  contact 
of  an  acceleration  sensor  which  detects  a  crash.  NADC's  work 
reported  by  Schulman  and  McElhenney  [1]  used  a  standard  light 
aircraft  emergency  locator  beacon  acceleration  sensor  for 
sensing  the  crash. 

Although  the  sensor  performed  satisfactorily,  it  was  by 
no  means  optimized  to  the  crash  characteristics  of  military 
helicopters.  Such  optimization  involves  the  choice  of  sensor 
location,  the  determination  of  the  required  time  to  fire  for 
effective  IBAHRS  protection,  and  the  prevention  of  inadvertent 
actuations  arising  from  hard  landings,  weapons  firing  or 
vibration. 

Neither  did  the  sensor  respond  omnidirectionally  since 
it  had  a  cosine  response  about  its  sensitive  axis.  Thus,  it 
was  not  capable  of  sensing  the  variety  of  angle  crashes  common 
in  helicopters. 

Finally,  to  make  the  IBAHRS  reliable,  some  type  of  redundant 
power  source  and  self-checking  and  diagnostic  features  are 
necessary.  Such  circuitry  is  common  in  automotive  air  bag 
restraint  systems. 

This  report  describes  the  design  and  preliminary  development 
of  a  sensor  system  which  addresses  the  deficiencies  in  the 
sensor  originally  used  for  IBAHRS  deployment.  The  methodology 
used,  the  resulting  design  and  the  testing  performed  are 
described.  Plans  for  areas  of  improvement  are  presented. 

SUMMARY  OF  RESULTS 

The  development  of  the  crash  sensor  system  was  conducted 
in  three  phases.  In  the  first  phase,  crash  data  in  the  form 
of  acceleration  histories  were  collected  through  a  literature 
search,  and  then  used  in  computer  simulations  to  optimize  the 
sensor  system  design.  Calibration  levels  were  determined  which 
provided  fast  response,  but  which  nevertheless  are  not  so  low 
as  to  allow  inadvertent  actuation.  A  single  sensor  location 
was  chosen  independent  of  the  specific  aircraft.  Also  included 
in  the  first  phase  was  the  preliminary  design  of  the  crash 
sensor  system.  For  sensing  acceleration  in  the  vertical 
direction  a  gas  damped  piston  in  tube  was  chosen.  An 
omnidirectional  spring-mass  sensor  was  chosen  for  acceleration 


-1- 


NADC-81 310-60 


sensing  in  the  horizontal  plane.  The  supporting  circuitry 
including  the  redundant  power  source  and  the  diagnostic 
capability  were  also  designed. 

During  the  second  phase  the  detailed  design  of  the  sensors 
and  the  diagnostic  circuit  was  done  along  with  the  integration 
of  thse  subsystems  and  the  packaging  of  the  entire  unit.  A 
prototype  system  was  built  and  tested  according  to  a  preliminary 
specification  [2]  written  on  the  basis  of  the  performance  require¬ 
ments  determined  in  the  first  phase  and  a  knowledge  of  military 
helicopter  operational  environments.  The  test  unit  performed 
satisfactorily  during  and  following  the  tests.  The  results 
are  documented  in  [3]. 

After  the  testing  was  completed,  new  information  relative 
to  the  advanced  attack  helicopter  (AAH)  became  available  which 
necessitated  changes  to  the  specification  to  accomodate  unusually 
high  g  maneuvers. 

The  second  phase  also  included  the  preparation  of  a 
complete  set  of  detailed  drawings  [4]  and  a  failure  mode 
effects  and  criticality  analysis  (FMECA)  [5].  The  FMECA 
identified  three  categories  of  failure  modes  with  exceptionally 
high  overall  risk  priority  indices.  These  categories  are  failure 
modes  arising  from  plating,  contamination  and  loose  parts. 
Inspection  techniques  which  can  be  implemented  in  large  volume 
production  were  proposed  to  increase  the  likelihood  of  detection 
of  these  problems,  thereby  reducing  their  overall  risk  priority 
indices  to  acceptable  levels. 

Phase  three  was  primarily  concerned  with  the  construction 
of  five  deliverable  systems.  At  the  beginning  of  phase  three, 
the  new  information  about  the  AAH  maneuvers  and  vibration 
levels  was  reviewed  carefully.  The  vibration  levels  are  much 
lower  than  those  used  in  the  original  preparation  of  the 
preliminary  specification.  The  high  g  maneuver  necessitated 
a  change  in  the  calibration  level  of  the  vertical  sensor. 

During  construction,  three  systems  were  built  with  the 
vertical  sensor  calibration  level  set  for  use  in  the  AAH.  The 
other  two  systems  were  calibrated  as  originally  specified. 

All  five  systems  were  required  to  meet  only  the  revised  vibration 
specification.  All  five  systems  were  given  a  series  of  acceptance 
tests  and  all  five  performed  satisfactorily.  The  systems  were 
delivered  to  NADC  for  laboratory  and  flight  test  use. 

CONCLUSION 

On  the  basis  of  available  crash  data  and  helicopter  environments, 
a  crash  sensing  system  capable  of  providing  effective  discrimina¬ 
tion  between  crash  and  non-crash  events  can  be  produced.  Such 
a  system  can  be  made  reliable  and  self-diagnostic. 
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RECOMMENDATIONS 

1.  Further  testing  using  the  five  systems  built  in  the  third 
phase  should  be  done  by  the  Government  to  verify  the  calibra¬ 
tion  level  of  both  the  regular  and  AAH  calibrations  in  one 

or  more  actual  helicopter  drop  tests  and  verify  the  insensitivity 
to  vibration  levels  in  actual  flight  conditions. 

2.  The  preliminary  specification  should  be  reviewed  by  the 
Government  with  an  eye  toward  reducing  the  severity  of  the 
environments  specified.  The  specification  currently  is  at 

least  as  stringent  as  it  need  be.  In  particular,  the  requirement 
for  operation  at  -55°C  increases  the  size  and  weight  of  the 
system  considerably. 

3.  Engineering  development  should  be  continued  to  refine  the 
design  and  develop  tooling  to  accomplish: 

9  An  overall  reduction  in  size  and  weight. 

9  An  adequate  environmental  seal  of  the  system. 

•  A  scheme  for  internal  modular  assembly  allowing  the  field 
replacement  of  parts. 

"  A  method  of  increasing  the  ruggedness  of  the  mountings 
of  the  internal  parts. 

4.  The  diagnostic  circuitry  should  be  redesigned  so  that  it 
not  only  indicates  a  failure  with  its  warning  lamp  but  also 
provides  a  means  for  determining,  in  the  field,  the  defective 
component.  Micro-processor  diagnostic  systems  which  do  this 
are  currently  in  use  in  automotive  air  bag  systems  and  should 

be  used  as  models  for  the  design  of  the  helicopter  crash  sensing 
system  diagnostic. 
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BACKGROUND 


The  process  of  optimization  of  a  crash  sensing  system  for 
any  given  application  is  many  faceted.  During  the  design 
process,  consideration  must  be  given  simultaneously  to  factors 
including  the  choice  of  sensor  type  and  location  in  the  aircraft 
and  the  ability  to  reliably  detect  a  crash  in  time  for  the  sensor 
to  be  effective  while  maintaining  adequate  rejection  of  non¬ 
crash  events.  Also,  the  performance  of  the  chosen  sensors  must 
not  be  so  sensitive  to  manufacturing  tolerances  that  they  cost 
too  much. 

A  series  of  computer  simulation  programs  are  employed  which 
allow  the  design  engineer  to  interactively  couple  his  sensor 
experience  with  computer  predicted  sensor  performance  In  as 
many  crash  events  as  possible  for  which  acceleration  data  is 
available. 


The  process  begins  with  the  collection  of  crash  data. 

These  data  are  entered  into  the  computer  to  verify  their 
accuracy.  For  each  crash  event,  the  required  sensor  response 
time  is  then  obtained  from  actual  occupant  motion  or,  if 
unavailable,  from  simulated  dummy  kinematics.  Given  the 
collection  of  response  times  for  all  crashes,  the  sensor 
designer  then  considers  a  variety  of  sensor  types  and  locations 
and  can  quickly  reject  those  which  show  little  promise.  For 
those  remaining,  he  can  then  modify  their  parameters  to  achieve 
optimum  response  to  crash  signatures.  This  same  variation  of 
parameters  also  highlights  those  designs  which  are  the  least 
acceptable  to  manufacturing  tolerances.  Armed  with  the  knowledge 
of  the  performance  characteristics  of  a  limited  number  of  sensor 
designs,  the  engineer  can  then  intelligently  select  the  best 
for  subsequent  detailed  design  and  development. 

CRASH  SENSOR  TYPE  EVALUATION 


Eight  generic  sensor  types,  three  predictive  and 
impact,  were  evaluated  and  rated  with  respect  to  nine 
Weights  for  the  nine  factors  were  determined  and  were 
calculate  weighted  totals  for  the  eight  sensors.  The 
weights,  and  totals  are  presented  in  Table  I. 


five  post 
factors . 
used  to 
ratings , 


The  generic  sensor  types  chosen  for  evaluation  are  those 
which  have  been  used  in  crash  sensing  systems  for  aircraft  and 
automobiles.  Three  predictive  sensor  types  considered  were 
radar,  sonar,  and  proximity.  Post  impact  types  included  four 
mechanical  types,  rolamite,  spring  mass,  gas  damped  piston  in 
tube,  and  crush  sensors.  The  non-mechanical  post  impact  type 
was  one  in  which  the  output  of  an  accelerometer  is  processed 
electronically . 


The  most  important  evaluation  factors  were  response  time, 
inadvertent  actuation  susceptibility,  environmental  stability, 
reliability,  weight  and  serviceability.  Of  secondary  importance 
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were  operational  history,  cost  and  complexity. 

Clearly,  predictive  sensor  types  are  faster  than  post  impact 
types.  Since  they  would  be  able  to  detect  an  impending  crash 
prior  to  any  structural  deformation,  and  since  helicopter  struc¬ 
tures  are  large,  it  would  likely  be  necessary  to  build  in  a  time 
delay  which  could  be  different  for  each  helicopter  type.  The 
squib  firing  would  have  to  be  delayed  by  some  amount  so  that 
the  harness  would  not  begin  to  deflate  before  maximum  force  load¬ 
ing  on  the  harness  occurred. 

The  post  impact  sensor  types  are  less  sensitive  to  inadver¬ 
tent  actuations  and  environmental  changes  than  the  predictive 
types.  This  is  because  they  require  physical  contact  of  the 
aircraft  structure  and  thus  cannot  be  misled  by  rain,  birds, 
and  other  airborne  projectiles. 

Primarily  because  of  their  simplicity,  post  impact  types 
are  less  costly,  more  reliable,  lower  in  weight,  and  easier  to 
service.  The  electronic  sensor  type  suffers  in  some  of  these 
respects,  but  not  nearly  so  much  as  the  predictive  sensors. 

The  three  predictive  sensors  stand  out  as  having  the  lowest 
ratings.  It  is  therefore  not  surprising  that  part  of  their  poor 
showing  was  due  to  a  lack  of  operational  history.  They  have 
been  sudied  in  the  laboratory  and  have  rarely  been  chosen  as 
the  design  for  implementation. 

Two  sensor  types,  spring  mass  and  gas  damped,  score  highly, 
with  the  rolamite  and  electronic  sensor  not  far  behind.  The 
crush  sensor  faired  poorly,  due  in  large  part  to  the  large  number 
of  individual  sensors  needed  to  adequately  cover  surfaces  of 
impact.  It  was  decided  to  investigate  the  rolamite,  spring  mass, 
and  gas  damped  sensors,  rejecting  the  electronic  one  because, 
in  the  likely  event  of  multiple  sensors  (of  possibly  different 
types),  it  would  be  easy  to  combine  mechanical  types  with  each 
other  and  not  with  the  electronic  sensor. 

CRASH  DATA  GATHERING,  PREPARATION  AND  VERIFTCATION 

It  was  hoped  that  instrumented  crashes  for  many  different 
helicopter  types  and  crash  conditions  would  be  found,  along  with 
hard  landing  and  in-flight  vibration  data  from  which  no-go 
criteria  could  be  developed.  The  search  was  quite  successful 
in  finding  a  relatively  large  number  of  crashes  and  helicopter 
types.  Several  crash  conditions  were  found,  although  most  tended 
to  be  about  40  ft. /sec.  in  horizontal  and  vertical  velocity. 

The  search  did  not  turn  up  any  no-go  events. 

Two  avenues  were  pursued  in  the  search  for  data — a  comput¬ 
erized  literature  search,  and  telephone  contacts  with  authors 
and  others  in  helicopter  testing  and  engineering.  The  result 
of  the  personal  contacts  and  the  computerized  literature  search 
ultimately  led  to  the  accumulation  of  about  25  documents  con- 
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taining  pertinent  information  on  18  different  instrumented  heli¬ 
copter  crashes  and  several  non-crash  events  of  interest.  A  sum¬ 
mary  of  this  information  is  presented  in  Table  II,  with  the  list 
of  references  to  the  documents  containing  the  data.  Each  crash 
event  has  been  assigned  an  identifier  (e.g.  T-18)  which  corresponds 
to  the  identifier  used  by  those  who  conducted  the  test.  In  two 
cases  there  was  no  identifier  or  it  was  not  known.  These  events 
were  called  UT-1  and  UT-2 . 

In  general,  the  documents  found  in  the  literature  search 
presented  acceleration  traces  for  several  locations.  Traces 
for  the  cockpit  floor  and  often  the  passenger  or  cargo  floor 
were  digitized  and  entered  into  the  computer.  Traces  for  the 
engine,  transmission,  fuel  cells,  and  other  distant  parts  of 
the  aircraft  structure  were  not  studied.  The  reasons  for  this 
were  twofold.  First,  few  of  these  structures  would  routinely 
be  involved  fearly  enough  in  the  crash  to  protect  the  crew,  so 
that  adequate  coverage  of  these  peripheral  locations  would  require 
an  unreasonably  large  number  of  sensors.  The  advantage  of  slightly 
earlier  detection  of  the  crash  does  not  warrant  the  increased 
complexity  and  attendant  reduction  in  reliability  of  a  distri¬ 
buted  sensor  system.  Second,  simulations  of  the  response  of 
sensors  in  the  crew  area  generally  predict  adequately  fast 
response.  In  all,  64  data  traces  were  digitized  and  used  in 
our  simulations. 

In  addition  to  spotting  human  errors  introduced  in  the  digi¬ 
tizing  process,  each  data  trace  was  integrated  to  find  the  velocity 
as  a  function  of  time.  Integration  of  each  acceleration  history 
should  yield  a  velocity  equal  to  the  "advertised"  impact  velocity 
in  the  direction.  Very  few  data  sets  passed  this  test.  Many 
real  factors  can  cause  this  to  happen,  along  with  some  which 
are  just  due  to  instrumentation  problems.  One  real  factor  is 
the  rotation  of  the  accelerometer  during  the  crash  with  respect 
to  its  intended  direction.  Since  a  crash  sensor  similarly  located 
would  have  undergone  the  same  rotation,  such  a  data  trace  is 
valid.  Experimentation  problems  include  accelerometer  breakage, 
wrong  scale  factors,  and  zero  drift.  Because  many  of  the  crash 
tests  were  10  to  15  years  old,  it  was  no  longer  possible  to 
discuss  instrumentation  errors  with  those  who  conducted  the 
teats.  Thus,  it  was  decided  to  use  all  reasonable  data  traces 
with  caution.  Those  which  caused  problems  for  the  sensors  would 
be  scrutinized  carefully. 

DEVELOPMENT  OF  PERFORMANCE  REQUIREMENTS 

Computer  simulation  proceeded  in  a  three-part  process. 

First,  the  functional  requirements  for  sensor  response  were 
determined  by  developing  time-to-fire  criteria  and  no-go 
criteria.  Next,  sensor  parameter  sets  were  generated  which, 
when  used  in  simulation  with  the  no-go  criteria  and  a  variety 
of  acceleration  histories  did  an  acceptable  job  of  meeting  the 
criteria  for  functional  response.  Finally,  the  effects  of 
perturbations  in  the  parameters  were  studied  to  help  establish 
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manufacturing  tolerances  and  calibration  criteria,  and  laboratory 
test  parameters  were  found. 

The  best  time-to-fire  criteria  come  from  actual  occupant 
motions  given  by  accelerometers  near  unrestrained  dummies.  If 
such  data  were  available  it  would  be  possible  to  doubly  integrate 
the  acceleration  histories  to  determine  occupant  motion  as  a 
function  of  time.  Some  limit  could  then  be  placed  on  the  allowed 
motion  prior  to  full  inflation  of  the  harness. 

Generally,  where  dummy  data  are  available,  they  are  for 
dummies  restrained  in  ways  which  vary  from  crash  to  crash.  A 
way  of  using  these  data  is  to  require  full  harness  inflation 
by  the  time  peak  acceleration  occurs  at  the  dummy's  head,  chest, 
or  pelvis.  Thus,  using  the  20  Millisecond  inflation  time  for 
the  IBAHRS,  the  required  time  to  fire  for  a  given  crash  would 
be  20  milliseconds  prior  to  the  earliest  peak  acceleration  load 
given  in  the  dummy  data  for  the  crash. 

When  dummy  data  are  not  available,  another  criterion  must 
be  used.  Such  a  criterion  is  based  on  the  motion  of  an  unre¬ 
strained  body  near  or  at  the  mounting  location  of  the  sensor. 

Also  required  is  that  the  occupant  velocity  at  the  time  of  initial 
contact  with  the  restraint  be  within  limits  based  on  those  used 
in  automotive  air  bag  specification.  Analyses  of  this  type  led 
to  the  criterion  that  the  sensor  must  fire  no  later  than  20 
milliseconds  before  an  unrestrained  body  has  moved  2£  inches. 

The  use  of  this  criterion  in  the  absence  of  dummy  data  is 
conservative,  since  the  actual  accelerations  of  an  occupant  are 
often  delayed  by  the  collapse  of  intervening  structures  such 
as  the  sears.  For  crashes  which  had  no  available  dummy  data, 
this  time-to-fire  criterion  was  applied  to  their  data  sets  using 
the  computer.  The  resulting  time-to-fire  requirements  are 
presented  in  Table  III,  which  additionally  shows  whether  the 
requirement  came  from  dummy  or  calculation  in  the  absence  of 
such  data. 

It  was  hoped  that  accelerometer  traces  of  non-crash  events 
such  as  hard  landings  and  in-flight  vibration  would  be  found. 

None  were.  The  approach  therefore  became  one  of  the  devising 
no-go  criteria  from  helicopter  vibration  specifications.  Early 
in  the  second  phase,  the  only  vibration  information  was  that 
in  MIL-STD-810.  Later  on,  actual  AAH  vibration  information 
showed  that,  the  MIL-STD-810  levels  were  unrealistically  severe 
for  operating  vibration.  Non-operating  vibration  should  still 
be  that  called  out  by  MIL-STD-810.  A  revised  operating  vibration 
specification  is  depicted  in  Figure  11.  The  analysis  which  led 
to  this  curve  is  given  in  the  Appendix. 

LOCATION  SELECTION 

In  automotive  crash  sensor  systems  the  sensors  are  always 
mounted  forward  of  the  passenger  compartment  so  as  to  detect 
the  crash  earlier.  This  is  necessary  because  automotive  struc- 
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tures  are  relatively  stiff,  allowing  the  crash  to  propagate 
quickly  through  the  engine  area  to  the  occupants.  This  location 
is  possible  because  automobile  crashes  generally  come  from  the 
front . 


In  a  helicopter,  the  likelihood  of  crashes  from  the  side 
and  bottom  is  comparable  to  that  from  the  front.  In  order  to 
achieve  the  fastest  detection  of  a  crash  from  all  directions, 
it  would  be  necessary  to  have  many  sensors  installed  around  the 
body  of  the  helicopter,  a  number  of  which  would  be  relatively 
unprotected  from  accidental  firings. 

Furthermore,  since  the  helicopter  structure  is  quite  soft 
and  much  larger  than  that  of  an  automobile,  the  propagation  of 
the  crash  from  the  exterior  to  the  cockpit  area  is  relatively 
slow.  Thus,  extremely  rapid  crash  detection  is  not  needed.  In¬ 
deed,  it  might  be  undesirable  because  structure  dependent  time 
delays  might  have  to  be  included. 

If  a  distributed  sensor  system  were  to  be  used,  simply  the 
multiplicity  of  sensors  would  complicate  the  system,  thus  compro¬ 
mising  its  reliability.  The  diagnostic  circuit  would  also  be¬ 
come  more  complex. 

In  view  of  the  above  considerations,  the  approach  was  to 
attempt  to  design  a  sensor  system  whose  sensors  would  be  located 
in  the  cockpit  itself.  Such  a  system  is  not  required  to  corre¬ 
late  acceleration  in  one  part  of  the  aircraft  with  later  accelera¬ 
tions  in  the  cockpit  area,  but  instead,  is  measuring  the  primary 
signature — that  acceleration  from  which  the  IBAHRS  is  to  protect 
the  crew. 

By  restricting  the  sensor  location  to  the  cockpit  area, 
dependence  on  the  exact  nature  of  the  aircraft  structure  is 
removed.  Such  a  system  should,  therefore,  work  equally  well 
in  all  helicopter  types. 

COMPUTER  AIDED  PRELIMINARY  DESIGN 

Three  types  of  sensors  were  initially  investigated — rolamite 
(unidirectional),  spring  mass  (omnidirectional),  and  gas  damped 
(unidirectional).  The  approach  was  to  develop  parameter  sets 
which  represented  sensors  that  a)  met  or  exceeded  the  time-to- 
fire  requirements,  b)  would  not  actuate  under  vibration,  and 
c)  had  parameters  which  were  readily  achievable  in  a  real  device 
with  no  great  difficulties  arising  from  manufacturing  processes. 

It  was  found  that  the  rolamite  sensor  could  uot  be  configured 
to  be  fast  enough  to  fire,  while  remaining  safe  under  vibration. 

It  is  possible  that  with  further  refinements  of  the  band  force 
parameters,  this  sensor  could  be  made  to  perform  acceptably. 
However,  it  was  felt  that  equal  effort  expended  on  the  other 
two  sensor  types  would  yield  even  better  performance.  This 
belief,  coupled  with  the  high  score  for  the  spring  mass  and  gas- 


NADC-81310-60 


damped  devices  relative  to  the  rolamite  (see  Table  I)  led 
Technar  to  propose  the  omnidirectional  sensor  for  crash 
detection  in  the  horizontal  plane  and  the  gas  damped  sensor 
for  the  vertical  direction.  Figures  1  and  2  are  schematic 
representations  of  the  two  chosen  sensors. 

The  omnidirectional  sensor  is  shown  at  rest  in  Figure 
1.  The  cylindrical  sensing  mass  is  loaded  downward  against 
the  base  of  the  cone-shaped  housing  by  the  conical  spring. 
Sufficient  acceleration  from  any  direction  in  the  horizontal 
plane  causes  the  mass  to  pivot  at  a  point  at  the  outer  edge 
of  its  base.  As  the  mass  tilts,  the  protrusion  from  its  base 
moves  upward  and  loads  the  ribbed  leaf  less.  At  the  firing 
angle,  the  normally  closed  contacts  have  already  opened,  and 
the  normally  open  contacts  just  close.  The  contact  gap  is 
such  that  under  vibration,  causing  the  mass  to  move  but  not 
fire,  the  normally  closed  contacts  remain  closed.  The  mass 
can  actually  tilt  through  an  angle  greater  than  the  firing 
angle.  This  overtravel  allows  an  increase  in  the  normally 
open  contact  force  and  decouples  the  mass  from  the  ribbed  leaf. 

The  gas  damped  sensor  to  be  used  to  sense  the  vertical 
accelerations  is  shown  at  rest  in  Figure  2.  Three  compression 
springs  are  employed  to  achieve  the  necessary  spring  rate  and 
contact  closures.  The  net  rate  of  the  normally  closed  contact 
spring  and  bias  spring  determine  the  rate  used  in  the  model. 

The  mass  is  initially  held  at  the  left  against  the  central 
stop  by  a  net  force  of  2  g's  including  the  effect  of  gravity. 

Acceleration  causes  the  piston  to  move  to  the  right  (down), 
opening  the  normally  closed  contact  spring  at  its  free  length 
shortly  before  the  normally  open  contact  spring  bridges  the 
contacts.  The  mass  can  overtravel  by  compressing  the  normally 
open  contact  spring  until  stopped  by  the  central  protrusion 
of  the  mass.  The  contact  force  thus  goes  up  during  overt.ravei. 

As  the  piston  moves,  air  is  pumped  both  through  the  hole 
and  arcund  the  circumference  from  the  forward  ullage  to  the 
aft  ullage.  The  compression  of  the  gas  provides  an  additional 
spring  rate  as  modeled  with  the  computer. 

The  omnidirectional  and  gas  damped  parameter  sets  were 
used  to  simulate  the  performance  of  a  system  comprised  of  one 
of  each  type.  This  system,  in  which  the  omnidirectional  spring 
mass  sensor  covers  the  horizontal  plane  and  the  gas  damped 
device  senses  the  vertical,  would  be  located  on  the  cockpit 
floor. 

The  object  of  the  simulation  was  to  predict  whether  or 
not  the  occupants  would  have  been  adequately  protected  in  the 
various  crashes  listed  in  Table  II.  That  is,  would  a  system 
as  described  above  function  as  fast  or  faster  than  the  minimum 
time  to  fire  for  any  occupant  and  any  direction  as  tabulated 
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Figure  1  -  Omnidirectional  Spring  Mass  Sensor  -  General  Arrangement 
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in  Table  III?  Table  IV  compares  the  required  time  to  fire 
(from  Table  III)  with  the  results  of  the  simulations.  Table 
IV  also  shows  which  of  the  two  sensors  would  have  fired  the 
squibs. 

Examining  Table  IV,  the  occupants  of  crashes  T-l,  T-22 
and  T-38  are  marginally  protected  (1  to  2  msec  late).  This 
time  lapse  is  within  the  expected  accuracy  of  the  simulations. 
Crashes  T-23  and  T-25  are  about  6  to  7  msec  late.  In  all  the 
remaining  crashes  the  occupants  are  comfortably  protected. 

Simulations  for  crash  T-23  had  to  be  based  on  the  sensors 
being  located  with  the  passengers,  since  no  cockpit  data  was 
available.  Generally,  cockpit  response  is  faster  than  that 
for  the  passenger /cargo  areas.  Probably  the  7  msec  lateness 
would  have  been  removed  had  cockpit  data  been  available. 

The  time  to  fire  required  from  crash  T-25  came  from  a 
spike  in  the  acceleration  history  of  the  copilot  pelvis  longi¬ 
tudinal  axis.  Other  histories  from  the  pilot,  copilot,  and 
passenger  dummies  show  more  significant  peak  loads  from  5  to 
10  milliseconds  later.  Thus,  the  proposed  sensor  system  would 
likely  orotect  all  of  the  occupants  to  a  large  degree, 
par-*  liarly  since  there  would  have  been  partial  inflation 
of  tne  harness. 

Some  of  the  parameters  for  both  sensors  were  selected 
to  determine  the  effects  on  sensor  performance  due  to  their 
variation.  Parameters  not  selected  for  this  study  were  already 
known  to  be  relatively  unimportant.  The  amount  of  variation 
chosen  for  each  one  was  such  that  ordinary  manufacturing 
practices  can  be  used  to  stay  within  the  resulting  tolerances. 

The  results  of  the  study  are  presented  in  Table  V.  None 
of  the  variations  in  any  of  the  parameters  would  be  troublesome 
if  it  occurred  alone.  The  most  critical  parameters  are  the 
piston-tube  gap,  the  travel  distance,  and  the  initial  force 
on  the  moving  mass.  No  surprises  were  uncovered. 

Looking  ahead  to  laboratory  testing  of  the  prototypes 
to  be  constructed,  a  nominal  threshold  curve  for  each  sensor 
was  computed.  Response  to  rectangular  pulses  was  chosen  because 
of  a  particular  piece  of  test  equipment  at  Technar.  Response 
to  other  shapes  can  easily  be  produced.  The  threshold  curves 
are  shown  in  Figure  3.  Sensor  time  to  fire  in  milliseconds 
is  given  parenthetically. 

A  complete  description  of  the  design  process  highlighted 
above  can  be  found  in  [22]. 

ELECTRICAL  ENERGY  STORAGE 

To  eliminate  the  possibility  that  the  power  supply  is 
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Table  IV 

Comparison  of  Required  Time  to  Fire 
with  Predicted  Time  to  Fire  from  simulation 


Required  Simulated  Firing  Sensor 

Time  to  fire  Time  to  Fire  V  =  vertical 

(msec)  (msec)  H  =  omnidirectional 


TABLE  V 
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interrupted  during  the  crash,  enough  energy  is  stored  in  the 
sensor  system's  own  capacitor  to  fire  the  harness  squibs.  This 
capacitor  is  charged  by  the  aircraft  power  supply  within  a 
few  seconds  after  power  up.  The  size  of  the  capacitor  was 
determined  by  taking  into  account  the  aircraft  power  supply 
specifications,  the  environmental  limits  for  the  system,  the 
energy  needed  to  fire  the  squibs,  parasitic  series  resistances, 
and  tolerances  on  all  parameters.  The  result  was  an  18,000 
microfarad,  40  volt  DC  capacitor  meeting  MIL-C-39018. 

DIAGNOSTIC  DESIGN 

The  diagnostic  circuit  portion  of  the  sensor  system  is 
used  to  verify  that  the  entire  system  is  working  properly. 

It  monitors  the  sensors,  their  secure  mounting  and  the  circuit 
itself,  and  provides  an  indication  of  any  failure  discovered. 
Diagnostic  requirements  were  developed  in  part  from  Technar's 
automotive  experience,  from  NADC  requests,  and  from  military 
aircraft  electrical  and  environmental  specifications.  The 
preliminary  design  reulting  from  these  requirements  was  con¬ 
structed,  and  was  found  to  operate  nominally. 

The  diagnostic  functional  requirements  are: 

a)  Must  not  degrade  the  reliability  of  the  firing  circuit 

b)  Must  provide  a  warning  light  indication  of  a  system 
malfunction. 

c)  Must  detect  all  single  failures  of  sensors,  intercon¬ 
nections,  and  as  many  components  of  the  diagnostic 
circuit  itself  as  possible. 

d)  Must  detect  power  supply  undervoltage. 

e)  Must  be  useable  for  multiple  sensors. 

The  diagnostic  environmental  requirements  include: 

a)  MIL-STD-704  Aircraft  Electric  Power 

Characteristics 

b)  MIL-STD-810  Environmental  Test  Methods 

c)  MIL-STD-454  Standard  General  Requirements 

for  Electronic  Equipment 

d)  MIL-E-5400  Military  Specification  Electronic 

Equipment,  Airborne,  General 

Specification  for 

The  diagnostic  circuit  electrically  integrates  the  sensor, 
the  storage  capacitor,  and  a  mounting  switch  used  to  sense 
secure  attachment  of  the  sensor  system  to  the  airframe.  The 
approach  used  to  accomplish  the  diagnostic  task  was  to  provide 
each  sensor  with  two  resistors  forming  a  voltage  divider  in 
the  normally  closed  (at  rest)  circuit.  Increases  in  the  total 
circuit  resistance,  caused  by  an  open  mounting  switch  or  a 
sensor  normally  closed  contact  problem  or  decreases  in  circuit 
resistance  due  to  a  leakage  path,  would  be  detected.  Such 
failures  would  turn  on  the  warning  light. 

In  order  to  check  the  electronic  circuit  itself,  upon 
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power  up,  the  warning  light  is  made  to  turn  on  briefly  if  there 
are  no  detected  malfunctions.  The  time  interval  during  which 
the  light  is  on  during  power  up  is  called  test  time,  and  is 
about  5  seconds  in  duration.  The  truth  table  for  the  diagnostic 
fuction  is  thus: 


Light  On  Light  Off 

Test  Time  OK  Failure 

Later  Failure  OK 

The  list  of  failures  checked  and  their  resulting  Indications 
is  given  in  Table  VI. 

The  diagnostic  circuit  diagram  is  shown  in  Figure  4. 
Twelve  functional  parts  have  been  blocked  off  for  reference. 

Block  1  shows  the  wiring  of  an  individual  sensor.  If 
the  sensor  is  nominal  and  at  rest,  the  normally  closed  circuit 
is  closed,  and  half  the  power  supply  voltage  appears  at  the 
tap  of  the  voltage  divider.  A  small  leakage  current  flows 
through  the  squibs.  Should  the  squibs,  the  mounting  switch, 
or  the  normally  closed  contact  open  or  increase  somewhat  in 
resistance,  the  voltage  at  the  tap  of  the  divider  will  rise. 
Should  there  be  leakage  to  ground  or  V  supply,  the  voltage 
at  the  tap  will  fall  or  rise  respectively.  The  diagnostic 
circuit  detects  a  variation  of  20X  or  more  in  the  nominal 
voltage  at  the  tap.  When  the  sensing  mass  moves  so  as  to 
close  the  normally  open  contacts  during  a  crash,  the  resistors 
are  shorted  out  and  the  resistance  of  the  resulting  circuit 
is  primarily  that  of  the  squibs.  At  that  time  the  auxiliary 
power  supply  capacitor  provides  the  energy  to  fire  the  squibs. 

Block  2  is  simply  the  power  supply  for  the  electronics. 
Block  3  contains  transient  suppressors  to  prevent  damage  to 
the  low  voltage  electronic  components  from  short  duration 
voltage  spikes  coming  through  the  sensor  wiring.  Transients 
on  the  main  power  supply  are  adequately  filtered  by  either 
the  storage  capacitor  or  the  bypass  capacitors  Cl,  C2,  and 
C3. 


In  normal  operation,  Block  4  further  divides  the  sensor 
readiness  voltage  down  to  the  range  suitable  for  the  electronic 
parts.  Block  5  contains  the  high  and  low  comparators,  which 
monitor  this  voltage.  The  high  and  low  comparator  outputs 
are  ORed  for  each  sensor  for  out-of-range  indication. 

Block  6  is  a  resistor  OR  which  takes  the  output  from  one 
or  more  Ored  comparators  and  turns  on  the  transistors  in  Block 
7,  thereby  lighting  the  warning  lamp. 

In  normal  operation  the  above  mentioned  blocks  detect 
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TABLE  VI 

Major  Failures  Detected  By  The  Diagnostic 
Circuit  And  Their  Indications 


Warning  Light 


Condition 

Test  Time 

Later 

NOMINAL 

ON 

OFF 

Squibs  open 

ON 

ON 

Mounting  switch  open 

ON 

ON 

Sensing  mass  not  in  "at  rest"  position 

ON 

ON 

Sensing  mass  in  firing  position 

OFF 

OFF 

Leakage  inside  sensor 

ON 

ON 

Storage  capacitor  shorted 

ON 

ON 

Power  supply  below  14  volts 

ON 

ON 

Warning  light  burned  out 

OFF 

OFF 

C4  shorted 

ON 

ON 

C4  open 

OFF 

OFF 

CJ1  pin  13  always  low 

ON 

ON 

U1  pin  13  always  high 

OFF 

OFF 

U1  pin  14  always  low 

OFF 

OFF 

U1  pin  14  always  high 

ON 

ON 

U1  pin  2  always  low 

OFF 

OFF 

U1  pin  2  always  high 

ON 

ON- 

U2  pin  2  always  low 

OFF 

OFF 

U1  pin  2  always  high 

ON 

ON 

Q1  shorted 

ON 

ON 

Q1  open 

OFF 

OFF 

Q2  shorted 

ON 

ON 

Q3  shorted 

ON 

ON 

U3  pin  10  always  low 

OFF 

OFF 

U3  pin  10  always  high  * 

ON 

ON 

U3  pin  4  always  low 

OFF 

OFF 

U3  pin  4  always  high 

ON 

ON 

U3  pin  11  always  low 

ON 

ON 

U4  pin  13  always  low 

ON 

ON 

U4  pin  .13  always  high 

OFF 

OFF 

U4  pin  1  always  low 

OFF 

OFF 

U4  pin  1  always  high 

ON 

ON 

Q4  open 

OFF 

OFF 

Q4  shorted 

ON 

ON 

Q5  open 

OFF 

OFF 

Q5  shorted 

ON 

ON 
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Figure  4  -  Diagnostic  Circuit  Schematic 
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failures  in  the  system  external  to  the  diagnostic  circuit. 

To  test  the  electronic  circuit  itself,  Blocks  8  through  12 
are  employed  to  modify  the  way  Blocks  1  through  7  normally 
work.  This  process  is  done  in  test  time,  about  5  seconds  in 
duration  at  power  up. 

Block  8  monitors  power  coming  up  and  does  not  start  the 
test  time  interval  until  the  voltage  on  the  auxiliary  power 
supply  capacitor  is  at  least  14  volts.  Also  included  in  Block 
8  is  the  capacitor  charging  resistor  R37  which  limits  the 
current  so  that  if  a  sensor  is  inadvertently  closed  at  power 
up,  the  squibs  will  not  fire.  Block  9  is  the  test  time  interval 
timer.  Block  10  pulls  the  high  limit  reference  voltage  to 
ground  (below  nominal),  thus  causing  all  three  high  comparators 
(if  they  are  working)  to  indicate  "bad". 

The  transistors  in  Block  11  short  the  output  of  the 
resistor  OR  to  ground  so  that  its  signal  is  not  available 
during  test  time  to  turn  on  the  light.  If  all  three  comparators 
and  their  corresponding  OR's  are  working  and  the  circuit  is 
in  test  time,  Block  12  then  supplies  the  current  to  turn  on 
the  transistors  in  Block  7.  The  OR  gate  in  Block  12  is  employed 
to  detect  a  shorted  transistor  in  Block  11. 

SYSTEM  INTEGRATION  AND  PACKAGING 
The  elements  of  the  system  consist  of: 


a) 

vertical  sensor 

b) 

horizontal  sensor 

c) 

mounting  switch 

d) 

diagnostic  circuit  board 

e) 

storage  capacitor 

f ) 

warning  light 

g) 

input  (power)  and  output  (squib) 

connectors 

h) 

case  for  the  above  with  mounting 

provisions 

The  entire  system  is  contained  in  a  single  package  whose 
size  is  173  mm  x  86.5  ram  x  82  ram.  The  weight  is  about  1.5 
kg.  The  large  size  of  the  package  is  due  primarily  to  the 
storage  capacitor.  Figure  5  is  a  photograph  of  the  assembled 
crash  sensor  system.  Figure  6  gives  installation  data.  Figure 
7  is  a  photograph  showing  the  general  arrangement  of  the  system 
components  called  out  in  detail  in  Figure  8. 

SENSOR  SYSTEM  SPECIFICATION 

A  preliminary  specification  for  the  crash  sensor  system 
was  developed  and  is  presented  below.  Modifications  to  the 
specifications  due  to  the  information  learned  about  the  AAH 
have  been  included.  The  rationale  behind  the  specification 
appears  in  [2].  The  AAH  background  information  is  presented 
in  the  Appendix. 
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Figure  8  -  Sensor  System  Final  Assembly  (cont.) 
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Acceleration  Threshold: 

The  system  shall  not  fire  when  subjected  to  an  acceleration 
pulse  anywhere  in  the  "NO  FIRE"  region  of  Figure  9  (Vertical 
Axis)  or  Figure  10  (Horizontal  Plane). 

The  system  shall  fire  when  subjected  to  an  acceleration 
pulse  anywhere  in  the  "MUST  FIRE"  region  of  Figure  9  (Vertical 
Axis)  or  Figure  10  (Horizontal  Plane). 

Response  Time  and  Closure  Duration: 

The  maximum  time  to  fire  (TTF)  and  minimum  contact  closure 
duration  (DUR)  are  given  below. 

Vertical  Sensor:  Half  sine  pulse  G  “10  t“15  msec 

TTF  ■  16  msec  DUR  *  5  msec 
Horizontal  Sensor:  Rectangular  pulse  G  =*6  t=12  msec 

TTF  “15  msec  DUR  *  5  msec 

Vibration  Operating: 

The  diagnostic  warning  lamp  shall  not  light  (indicating 
a  sensor  not  maintaining  closure  of  the  normally  closed  circuit) 
when  subjected  to  the  vibration  curve  in  Figure  11. 

Contact  Resistance: 

The  resistance  of  the  normally  closed  contact  of  the 
sensor  shall  not  exceed  500  milllohms.  The  resistance  of  the 
normally  open  contacts  of  the  sensors,  when  closed  by  the 
application  of  10  g's  shall  not  exceed  100  milliohms. 

Current  Carrying  Capacity: 

The  normally  open  contacts  of  each  sensor  shall  be  capable 
of  carrying  85  amperes  for  250  psec. 

Electrical  Energy  Storage: 

The  system  shall  be  capable  of  supplying  17.8  amperes 
for  at  least  3  milliseconds  to  a  load  of  .23  ohms  after  having 
been  disconnected  from  the  aircraft  power  supply  for  up  to 
5  seconds. 

Mounting  Force: 

The  mounting  switch  shall  require  at  least  25N  to  actuate. 
Fault  Indication: 

The  system  shall  be  capable  of  detecting  the  following 
system  failures  and  of  providing  an  indication  of  failure  via 
the  diagnostic  warning  lamp. 

a)  Squibs  open 

b)  Mounting  switch  open 

c)  Sensing  mass  not  in  "at  rest"  position 

d)  Sensing  mass  in  firing  position 

e)  Electrical  leakage  inside  sensor 

f)  Storage  capacitor  shorted 


Pulse  Height  (g's) 
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g)  Power  supply  below  12.5  volts 

h)  Warning  light  burned  out 

i)  Failures  of  semiconductors  in  the  diagnostic  circuit 

Detection  and  indication  via  the  warning  lamp  of  any  single 
failure  is  required.  Detection  and  indication  of  multiple 
failures  is  not  required. 

Weight,  Size: 

The  mass  of  the  system  shall  not  exceed  2.4  Kg.  The  size 
of  the  system  shall  not  exceed  1250  cm3. 

Electrical  Interface  Requirements: 

The  electrical  schematic  for  the  system  shall  be  as  in 
Figure  12. 

Life: 

The  storage  life  of  the  system  shall  be  at  least  5  years. 

The  operating  life  shall  be  a  minimum  of  5000  hours  or  10  squib 
firings. 

Erratic  Performance: 

At  any  time  during  its  operation  the  system  shall  not 
exhibit  abnormal  behavior  or  erratic  performance  even  though 
such  behavior  is  within  the  limits  of  performance  specified 
herein. 

Insulation  Resistance: 

The  resistance  from  case  to  any  other  input  or  output 
pin  shall  be  at  least  10  megohms  at  250  VDC. 

Strength  of  Enclosure: 

The  system  shall  be  contained  in  a  single,  rugged  metal 
can  capable  of  protecting  the  system  from  damage  during  a  95th 
percentile  potentially  survivable  crash. 

Altitude: 

The  system  shall  operate  within  limits  when  tested  according 
to  MIL-STD-810C ,  Method  500.1,  Procedure  I. 

High  Temperature  -  Operating  and  Storage: 

The  system  shall  operate  within  limits  during  and  following 
testing  according  to  MIL-STD-810C ,  Method  501.1,  Procedure 
I,  except  that  the  temperatures  in  steps  2  and  4  shall  be  85°C. 

Low  Temperature  -  Operating  and  Storage: 

The  system  shall  operate  normally  at  -55°C  following 
storage  at  -65°C  in  accordance  with  MIL-STD-81QC ,  Method 
502.1,  Procedure  I. 

Humidity : 

The  system  shall  operate  normally  when  tested  in  accordance 
with  MIL-STD-810C ,  Method  507.1,  Procedure  I. 
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Warning  Lamp 


Celesco  105  Squibs  (4) 


Figure  12  -  Sensor  System  Electrical  Schematic 
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Sand  and  Dust : 

The  system  shall  operate  normally  following  exposure  to 
dust  per  MIL-STD-810C ,  Method  510.1,  Procedure  I. 

Vibration,  Non-Operating: 

The  system  shall  operate  normally  following  exposure  to 
sinusoidal  vibration  in  accordance  with  MIL-STD-810C ,  Method 
514.2,  part  1,  curve  M. 

Shock : 

The  system  shall  operate  normally  after  testing  in  accordance 
with  MIL-STD-810C ,  Method  516.2,  Procedures  II  (transit  drop) 
and  III  (crash  safety). 

Voltage  Range: 

The  system  shall  operate  normally  over  a  steady  state 
voltage  range  of  22  to  29  VDC  (Ref.  MIL-STD-704C ,  Table  II). 

Voltage  Transients: 

The  system  shall  operate  normally  when  subjected  to  the 
transient  voltage  conditions  given  by  Figure  10  of  MIL-STD- 
704C  (reproduced  herein  as  Figure  13). 

Overvoltage  and  Undervoltage: 

The  system  shall  operate  normally  when  subjected  to  the 
overvoltage  and  undervoltage  conditions  given  by  Figure  12  of 
MIL-STD-704C  (reproduced  herein  as  Figure  14). 

Weapons  System  Firing: 

The  system  shall  not  fire  when  subjected  to  the  simulated 
gunfire  vibration  tests  of  MIL-STD-810C ,  Method  519.2.  Note 
that  the  parameters  needed  to  describe  such  a  test  are  dependent 
on  the  geometry  of  the  aircraft  and  the  weapon  location,  number, 
and  type.  Analysis  of  a  specific  installation  is  likely  to 
show  that  because  of  the  centralized  location  (between  pilot 
and  co-pilot  seats  on  the  floor)  the  system  will  be  sufficiently 
far  removed  from  the  weapons  so  as  to  make  this  testing  unnecessary. 

Electromagnetic  and  Electrostatic  Interference: 

It  is  unnecessary  to  specify  or  test  for  these  environments 
due  to  the  metal  can  protecting  the  system  which  acts  as  a  shield. 

Hazards  of  Electromagnetic  Radiation  to  Ordnance  (HERO): 

The  electronic  activity  of  the  system  is  essentially  DC; 
thus  no  EMR  will  be  produced.  No  testing  is  necessary. 
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APPENDIX 

BACKGROUND  FOR  DESIGN  AND  SPECIFICATION 
MODIFICATIONS  FROM  AAH  DATA 


Late  in  Phase  II  it  was  learned  that  the  Advanced  Attack 
Helicopter  (AAH)  can  perform  a  3.5  g  climb  maneuver  of  sufficient 
duration  that  a  vertical  sensor  calibrated  to  the  original  threshold 
curve  would  fire.  The  asymptote  of  the  original  curve  was  2.5 
g's.  A  new  threshold  curve  was  generated  whose  asymptote  is 
3.7  g's  (above  the  3.5  g's  of  the  maneuver).  This  is  accomplished 
by  increasing  the  bias  g-level  due  to  the  bias  spring.  Its 
free  length  was  increased.  To  compensate  for  this  reduced 
sensitivity  the  amount  of  gas  damping  was  reduced  by  enlarging 
the  orifice  slightly.  The  result  is  a  threshold  curve  somewhat 
flatter  than  the  original  (see  Figure  9).  Computer  simulations 
were  performed  to  verify  satisfactory  performance  on  all 
acceleration  histories. 

At  the  same  time  the  3.5  g  maneuver  was  investigated, 
measured  vibration  data  was  also  available.  All  helicopters 
with  which  Hughes  Helicopter  engineering  personnel  have  bad 
experience  have  much  lower  vibration  levels  than  those  set  forth 
in  MIL-STD-810.  Referring  to  Figure  11,  note  the  two  vibration 
levels  appropriate  to  the  AAH.  The  worst  measured  level  at 
.22  g's  and  19.3  Hz  is  insignificant.  The  worst  theoretical 
level  at  .6  g's  and  19.3  Hz  is  the  limit  of  the  AAH  structure. 

Hughes  also  supplied  Technar  with  a  copy  of  International 
Standard  2631,  Guide  for  the  Evaluation  of  Human  Exposure  to 
Whole-Body  Vibration,  in  which  human  fatigue  limits  are  presented. 
The  highest  vibration  levels  can  be  tolerated  only  for  short 
times.  The  1  minute  human  fatigue  limit  is  plotted  as  the 
curved  line  in  Figure  11. 

If  the  operating  vibration  specification  is  more  severe 
than  both  the  human  fatigue  limit  (at  which  the  pilot  can  no 
longer  control  the  aircraft)  .  nd  the  worst  theoretical  vibration 
level  (at  which  the  aircraft  structure  fails)  the  crash  sensing 
system  will  perform  satisfactorily.  Thus,  the  revised  operating 
vibration  level  is  shown  as  a  solid  curve  skirting  the  human 
fatigue  limit  curve  on  the  high  side.  Non-operating  vibration 
levels  can  remain  the  same  in  accordance  with  MIL-STD-810. 
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